CadrenFoundation

Open standard · European finance

A shared frame for testing AI and data.

Banks, fintechs and data holders are told to prove that their AI is safe, their data is anonymous and their people stay in control. There is no common way to show it. The Cadren Foundation is developing an open standard for exactly that: free to use, published in full, and open for anyone to challenge.

Foundation in formation · Standard v0.1 in draft
01

Why a standard

Regulation tells firms what to achieve. It rarely tells them how to show they have achieved it.

The EU AI Act, GDPR, DORA and anti-money-laundering rules all ask for evidence: that a model behaves consistently, that released data cannot be traced back to people, that human oversight actually works. Today every firm, auditor and vendor answers those questions differently, which makes results hard to compare and easy to dispute.

A public, testable standard changes that. When the method is open, a result means the same thing to the firm, its supervisor and its customers.

02

The standard

The draft is organised in six sections. Each contains test cards: what is tested, how, what counts as a pass, and which EU rules it supports.

A

Anonymity

Can released or synthetic data be linked back to people? Attack-based tests for singling out, linkage and inference.

B

Decisions

Does a system reach consistent, explainable outcomes when it sees the same case more than once?

C

Changes

Does behaviour hold when models, prompts or underlying data are updated?

D

Oversight

Can the people in the loop actually notice, question and override a wrong result?

E

Scams

Does the system recognise and resist fraud and social-engineering patterns seen in real incidents?

F

Agents

Do AI agents acting on accounts stay within their permissions, and can they be hijacked?

Each gate is one section of the standard. Whatever a gate catches is flagged with that section's letter.

Version 0.1 is a working draft. If you would like to read or review it, email us for the draft.

03

Principles

01Publishdraft is public02Attackanyone tries to break it03Fixweaknesses published04Releasenext versionREPEAT FOR EVERY VERSION01Publishdraft is public02Attackanyone tries to break it03Fixweaknesses published04Releasenext versionREPEAT FOR EVERY VERSION
  1. OpenThe standard and its test methods are published in full and free to use.
  2. AttackableAnyone may try to break it. Weaknesses found by others are published and fixed in the next version.
  3. Evidence over assertionA claim counts when a test supports it, not when a policy document states it.
  4. Grounded in incidentsTests are mapped to real enforcement actions and failures, so the standard tracks what actually goes wrong.
  5. NeutralNo single vendor, buyer or tester has special rights over the standard.
04

Governance

Writing a standard and selling tests against it are different jobs. We keep them in different organisations.

Non-profitCadren Foundation

Writes and publishes the standard

PublicOpen standard

Free to use, open to challenge

Any testerCadren Labs and others

Test systems against the standard

UsersBanks, fintechs, data holders

Get results that mean the same everywhere

Findings, weaknesses and real incidents flow back into the next version

In the interest of transparency: the interim board members, Alex Murphy and Man Yong Toh, are also setting up Cadren Labs. We state this on every public contribution we make.

05

Publications

Response to the EDPB consultation on Guidelines 02/2026 on anonymisationSupports a per-recipient approach and asks that documented attack testing be recognised as evidence of insignificant re-identification risk.
Consultation
Cadren Open Standard v0.1Working draft covering the six sections above. Available for review on request.
Draft
06

Board (interim)

Interim board member

Alex Murphy

Twenty years leading programmes in cybersecurity and critical infrastructure, including for Shell, T-Systems and Schiphol.

At Cadren

Leads the test methods and the open review process, and keeps the standard's security and governance in order.

Interim board member

Man Yong Toh

Strategy and innovation work for banks including ING, ABN AMRO and bunq, and former Head of Strategy at R/GA.

At Cadren

Works with banks, fintechs and regulators to put the standard into use, and leads Cadren's public consultation responses.

Join the board. We are looking for independent board members and reviewers from banking, data protection and academia, so that the standard is not governed only by people with a commercial interest in it.

Get in touch
07

Contact

To review the draft, contribute a test, report a weakness or discuss a consultation:

info@cadren.org